Vulnerabilities

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled in…

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.

DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment.

DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.

DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.

DBI versions before 1.648 for Perl saved errors in a limited-sized buffer.

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.

Perl threads have a working directory race condition where file operations may target unintended paths.

A heap buffer overflow vulnerability was discovered in Perl.

Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions.

A vulnerability was found in Perl.

A vulnerability was found in perl 5.30.0 through 5.38.0.

In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

CPAN 2.28 allows Signature Verification Bypass.

Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image

An issue was discovered in the DBI module before 1.643 for Perl.

An issue was discovered in the DBI module through 1.643 for Perl.

A buffer overflow was found in perl-DBI < 1.643 in DBI.xs.

An untrusted pointer dereference flaw was found in Perl-DBI < 1.643.

An issue was discovered in the DBI module before 1.632 for Perl.

An issue was discovered in the DBI module before 1.632 for Perl.